Profiling page: per-turn phase timings, live in the web dashboard

The engine already tracks where each turn's wall time goes (expert-disk
service, I/O wait, expert matmul, attention, lm_head) — it just only spoke
at exit or under PROF=1. Stream it instead:

- glm.c: mux serve emits a per-turn "PROF" protocol line next to TIERS/HITS
  (window deltas per request, same convention as the STAT hit%); the phase
  window base is now always captured (a few loads per request).
- openai_server.py: parses PROF into a 120-turn rolling window and serves it
  at /profile (read-only, same trust level as /health).
- web: new Profiling tab — stat tiles (tok/s, wall, tokens/forward, disk
  service), wall-time composition bars for the last turn and the window,
  per-turn throughput and stacked phase columns with hover readouts, and a
  table of recent turns. Disk service is shown apart from the stack: it
  overlaps with compute, so only the I/O wait the compute thread felt counts
  inside wall time. Phase colours are a CVD-validated set with gaps + legend
  + table so identity never rides on colour alone.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WhTmF8yvEBgSkUKSVfZF7P

web/README.md

@@ -17,9 +17,14 @@ npm test
 npm run build
 ```
 
+Besides Chat and Brain, the **Profiling** tab charts where the engine spent
+each turn's wall time (I/O wait, expert matmul, attention, LM head) from the
+server's `/profile` endpoint — a rolling window of per-turn `PROF` snapshots
+emitted by the engine.
+
 The test suite stays browser-light: API requests use a mocked `fetch`, while
 runtime capability and storage behavior are covered through pure helpers. It
-checks that `/health` is resolved next to (not below) the OpenAI `/v1` prefix,
+checks that `/health` and `/profile` are resolved next to (not below) the OpenAI `/v1` prefix,
 supports both boolean and numeric `scheduler.active` responses, and sends the
 colibrì-specific `cache_slot` field only when KV-slot support was advertised.